Market adoption of wireless LAN (WLAN) technology has exploded, as users from a wide range of backgrounds and vertical industries have brought this technology into their homes, offices, and increasingly into the public air space. This inflection point has highlighted not only the limitations of earlier-generation systems, but the changing role WLAN technology now plays in people's work and lifestyles, across the globe. Indeed, WLANs are rapidly changing from convenience networks to business-critical networks. Increasingly users are depending on WLANs to improve the timeliness and productivity of their communications and applications, and in doing so, require greater visibility, security, management, and performance from their network.
As enterprises and other entities increasingly rely on wireless networks, monitoring and management of the components implementing the wireless network environments becomes critical to performance and security. Indeed, wireless networks pose security risks not generally encountered in wired computer networks. For example, employees or malicious users may connect an unauthorized (“rogue”) wireless access point to the corporate network, exposing the network to any wireless client in the coverage area of the access point, and possibly affecting the performance of the enterprises own wireless network infrastructure.
To detect rogue access points affecting a wireless network deployment, prior art processes, such as site surveys and periodic inspections, typically involve a human tester roaming throughout the wireless network environment with specialized equipment, such as a WLAN tester, that sweeps the wireless coverage area and stores the resulting data for analysis of one or more attributes of the wireless network deployment, such as the presence and identity of access points. Such site surveys and inspections, however, are time consuming and expensive. In addition, the analysis of the wireless network environment is performed with data gathered at a single point in time and, therefore, is not responsive to periodic or subsequent changes associated with the wireless network environment (such as installation of new rogue access points, etc.).
In addition, rogue access points may also affect the performance of a wireless network. In an Ethernet LAN (IEEE 802.3), the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) protocol establishes how simultaneous transmissions (packet collisions) are handled. In a WLAN, collision detection in this manner is not possible due to what is known as the “near/far” problem: to detect a collision, a station must be able to transmit and listen at the same time. To account for this difference, the 802.11 protocol uses a slightly different protocol known as Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) or the Distributed Coordination Function (DCF). CSMA/CA attempts to avoid packet collisions by using explicit packet acknowledgement (ACK), which means that an ACK packet is sent by the receiving station to confirm that a packet arrived intact. CSMA/CA works by having the transmitting wireless station sense the air for wireless traffic. If there is no activity detected, the transmitting wireless station will wait an additional random period of time. If there still is no activity, the wireless station transmits the data. If the packet is received intact, the receiving station will send and ACK frame that, once received by the original sender, completes the transmission. If the ACK command is not received in a predetermined period of time, the data packet will be resent under the assumption that the original packet experienced a collision. CSMA/CA also handles other interference and radio-wave related problems effectively, but creates considerable overhead. Accordingly, the presence of rogue access points operating on overlapping channels within the vicinity of an authorized access affects the performance of the enterprise's wireless network.
Given the collision avoidance mechanisms employed in 802.11-compliant wireless networks, management and monitoring of the wireless network airspace (for example, to ensure that wireless access points do not interfere with one another) are critical to the performance of the wireless network environment. The administrative or management functionality associated with WLAN networks, however, generally lacks an integrated and/or automated means of detecting rogue access points. Hand-held scanners, AP startup scans, or full-time scanning devices are the current methods of obtaining data characterizing the network devices within a wireless network environment. Accordingly, many WLANs do not perform at optimum speed due to overlapping channel interference and rogue access points (i.e., access points installed without authorization and/or knowledge of a network administrator).
In light of the foregoing, a need in the art exists for methods, apparatuses and systems that facilitate detection of rogue access points in wireless network environments. Embodiments of the present invention substantially fulfill this need.